CVE-2026-89935 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
iio: light: apds9306: fix PM reference leak in apds9306_read_data()
apds9306_read_data() calls pm_runtime_resume_and_get() but several error paths return directly without calling pm_runtime_put_autosuspend(), leaking the runtime PM reference and preventing the device from autosuspending.
Use PM_RUNTIME_ACQUIRE_AUTOSUSPEND() and PM_RUNTIME_ACQUIRE_ERR() to automatically handle runtime PM reference release on all return paths.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel driver for the apds9306 ambient light sensor contains a resource management flaw within its data reading routine, specifically in the function apds9306_read_data(). This vulnerability stems from an improper handling of runtime power management references acquired during device initialization or access. When the driver invokes pm_runtime_resume_and_get() to ensure the hardware is powered on and active for data retrieval, it increments a reference count that tracks how many users are currently accessing the device. Standard operating system behavior requires that every successful acquisition of such a reference must be balanced by a corresponding release call when the operation concludes or fails. In this specific implementation, several error paths within apds9306_read_data() return directly to their callers without invoking pm_runtime_put_autosuspend(). This omission means that while the function exits due to an error condition, the reference count remains elevated, effectively leaking a power management resource.
The operational impact of this leak is primarily related to system power efficiency and device lifecycle management rather than immediate security exploitation or data integrity loss. Because the runtime PM reference is not released upon failure, the kernel perceives that there are still active users for the apds9306 sensor even when it should be idle. Consequently, the hardware cannot transition into a low-power autosuspend state. Over time, if this function is called repeatedly in error scenarios, multiple leaked references can accumulate. This prevents the device from powering down, leading to increased power consumption and potentially draining battery life faster than intended on mobile or embedded systems where such sensors are commonly deployed. While not a direct vector for privilege escalation or remote code execution, it represents a denial of service against system energy efficiency goals and could theoretically contribute to resource exhaustion in extreme cases if the leak is triggered frequently by malicious input causing repeated errors.
From a vulnerability classification perspective, this issue aligns with CWE-401, which describes missing release of memory after successful allocation, although here the resource being leaked is a power management reference rather than traditional heap memory. It also relates to CWE-755, improper handling of unusual or exceptional conditions, as the error paths fail to perform necessary cleanup operations. In terms of attack surface and behavior mapping under MITRE ATT&CK for Enterprise, this flaw does not map directly to standard offensive techniques but reflects a deficiency in defensive resource management that could be leveraged indirectly if an attacker can force repeated failure states to degrade system performance or battery life over time. The root cause is identified as improper cleanup on error paths within the driver's IIO subsystem implementation.
To mitigate this vulnerability, the fix involves refactoring the apds9306_read_data() function to ensure that all exit points properly release the acquired runtime PM reference. This was achieved by utilizing specific kernel macros designed for automatic resource management: PM_RUNTIME_ACQUIRE_AUTOSUSPEND and PM_RUNTIME_ACQUIRE_ERR. These helpers abstract away the manual calls to pm_runtime_put_autosuspend(), ensuring that whether the data read succeeds or fails, the power management state is correctly updated. By integrating these macros into the error handling logic, developers guarantee consistent behavior across all code paths. This approach reduces the likelihood of future regressions and simplifies maintenance by centralizing the cleanup logic within well-tested kernel utilities rather than relying on manual calls scattered throughout complex conditional branches.